poky/meta at 31ea437bf7785201dd4fb04622ec97feba110c93 - poky

mirror of https://git.yoctoproject.org/poky synced 2026-05-09 17:39:31 +00:00

Files

T

Soumya Sambu 31ea437bf7 python3: Fix CVE-2024-8088

There is a HIGH severity vulnerability affecting the CPython "zipfile"
module. When iterating over names of entries in a zip archive (for example,
methodsof "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()",
etc) the process can be put into an infinite loop with a maliciously crafted
zip archive. This defect applies when reading only metadata or extracting
the contents of the zip archive. Programs that are not handling
user-controlled zip archives are not affected.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-8088

Upstream-Patch:
https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec

(From OE-Core rev: 2d98276ba70ed6c44afecd42a7352f1b3030438f)

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>

2024-09-09 06:08:10 -07:00

classes

create-spdx-*: Support multilibs via SPDX_MULTILIB_SSTATE_ARCHS

2024-08-06 19:11:18 -07:00

classes-global

insane.bbclass: remove leftover variables and comment

2024-07-26 07:43:46 -07:00

classes-recipe

qemuboot: Trigger write_qemuboot_conf task on changes of kernel image realpath

2024-08-26 05:18:44 -07:00

conf

maintainers.inc: add self for unassigned python recipes